


Issue #7 / The Monthly Journal of the American Hacker / October 2004 


Welcome to Green Bay Professional Packet Radio's (www.gbppr.org) crappy 
magazine! 


Varmint, scum, menace to the hacking industry. You're the lowest member of the 
food chain and you'll probably be replaced by the $2600 subscriber. 


Table of Contents 
¢ Page 2 / Translations /1A ESS 


¢ Bell System Practice on software line translations for the 1A ESS. 


¢ Page 25 / DMS-100 Login Control Table (LGINCTRL) 
Parameter values for the Nortel DMS-100 Login Control table. 


¢ Page 28 / DMS-100 Terminal Device Table (TERMDEV) 
¢ Parameter values for the Nortel DMS-—100 Terminal Device table. 


¢ Page 33 / DMS-100 Milliwatt Data Table (MWDATA) 
¢ Parameter values for the Nortel DMS-100 Milliwatt Data table. 


¢ Page 35 / Rent-A-Cop Jammer 
¢ Easily jam shopping mall repeater systems. 


« Page 37 / Receiving 900 MHz Band Cordless Phones 
@ High performance SIGINT receiving setup. 


¢ Page 42 / Bonus 
@ DMS-—100 Quick Reference Guide (external file). 


« Page 43 / The End 
¢ Editorial and Rants. 


Translations / 1A ESS 


BELL SYSTEM PRACTICES 
AT&TCo SPCS 


SECTION 231-045-145 
Issue 1, June 1980 


TRANSLATIONS 
SOFTWARE SUBSYSTEM DESCRIPTION (SSD) 


2-WIRE NO. 1 AND NO. 


1A ELECTRONIC 


SWITCHING SYSTEMS 


CONTENTS 
GENERAL 
INTRODUCTION 


PURPOSE OF THE TRANSLATION SUBSYSTEM 


SCOPE OF SECTION 
PIDENTS DESCRIBED IN THIS SECTION 


SYSTEM LEVEL DESCRIPTION AND INTERFACES 


BACKGROUND 

SUBSYSTEM DESCRIPTION 

BASE LEVEL PROCESSING 

GENERAL TRANSLATION SEQUENCE 


RECENT CHANGE AND TRANSLATION DATA 
(NO. 1A ESS) 


A. Permanent 

B. Temporary 

C. Delayed 

TRANSLATION SUBSYSTEM ROUTINES 
LINE TRANSLATIONS 

LEN TRANSLATIONS 


DN TRANSLATIONS 


PAGE 


NOTICE 


CONTENTS 


TRUNK TRANSLATIONS 


A. Universal Trunk Translations 


B. Miscellaneous Trunk Translations 


ROUTING AND CHARGING TRANSLATIONS 


A. Normalized Office Code and Number 


Not for use or disclosure outside the 


Bell System except under written agreement 


Printed in U.S.A. 


Group Number Tables 12 
B. Rate Center Table 12 
C. 3-/6-Digit Code Translation 12 
D. Rate and Route Pattern Translator 12 
MISCELLANEOUS TRANSLATIONS 12 
A. Master Scanner Number Translations 
12 
B. Unit Type Translations 13 
C. Universal Service Order Code Translations 
13 
D. Central Pulse Distributor Translations 
13 
TRANSLATION SUBSYSTEM PIDENTS 13 
PIDENT NEJR 13 
PIDENT TRBD 13 
A. Rate and Route Translations 13 
Page 1 








nN 


Translations / 1A ESS 


SECTION 231-045-145 


CONTENTS 
B. Digit Conversion Routines 


C. International Direct Distance Dialing 
(IDDD) Code Translations 


D. Tandem Digit Interpretation 
E. Speed Calling Digit Interpretation 
PIDENT TRBL 

A. Directory Number Entry Points 
B. Main Leg 

C. DN Major Class Vector Table 
PIDENT TRCD 

PIDENT TRCL 

PIDENT TRLC 

PIDENT TRML 

PIDENT TRBT 


A. Trunk and Peripheral Equipment Routines 


B. Trunk Hunt and Restore Routines 
PIDENT TRCT 
PIDENTS TRUR AND TRANCOMN 


TRANSLATION DATA VERIFICATION MESSAGE 
PIDENTS 


PIDENT TVMN 

ABBREVIATIONS AND ACRONYMS 
REFERENCES 

BELL SYSTEM PRACTICES 


OTHER 


Page 2 


PAGE 








CONTENTS PAGE 
Figures 
1. System Level Interface 5 
2. No. 1A ESS Control Software 6 
3. Simplified Translation Routines for No. 1A 
Ess 7 
4. Translation Data Verification Message 1/O 
System 19 
Tables 
A. Translation Subsystem PIDENTS 4 
B. DN Major Class Vector Table 16 
C. Translation Data Verification Messages 
—TVBL 21 
D. Translation Data Verification Messages 
—TVBT 22 
E. Translation Data Verification Messages 
—TVCD 22 
F. Translation Data Verification Messages 
—TVBD 23 
G. Translation Data Verification Messages 
—TVCL 23 
1. GENERAL 
INTRODUCTION 
1.01 This section describes the software associated 


1.02 


with the translation subsystem operating in 
the No. 1 and No. 1A Electronic Switching Systems 
(ESSs). 


When this section is reissued, the reason 
for reissue will be stated in this paragraph. 


wo 
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1.03 Part 5 of this section provides a defined list 
of abbreviations and acronyms used in this 
section. 


PURPOSE OF THE TRANSLATION SUBSYSTEM 


1.04 The purpose of the translation subsystem is 

to store, retrieve, and interpret office 
dependent data. As with any processing system, 
an ESS must have certain information available as 
a basis for logical decisions. This information is 
called a “data base” in general computer science 
terms. The No. 1 and No. 1A ESSs have a data 
base composed of office parameters and translations. 
This section is concerned with how the information 
in translations is accessed by the central processor. 


SCOPE OF SECTION 


1.05 The information provided in this section 
includes a description of: 


(a) The organization and operation of the 
translation subsystem at the system level 


(b) The translation subsystem PIDENTS (see 
Table A). 


Information unique to the No. 1A ESS application 
is so noted. Applications which are unique to 
No. 1 ESS are not described in this document. 


PIDENTS DESCRIBED IN THIS SECTION 


1.06 Table A provides a PIDENT to program a 
number cross-reference for the translation 
subsystem PIDENTS described in this document. 


2. SYSTEM LEVEL DESCRIPTION AND INTERFACES 
BACKGROUND 


2.01 Inearly electromechanical telephone systems, 

switchers were directly controlled by the 
dialed digits. Digit storage and interpretation 
were not needed since the switcher was under 
direct control of the customer. As telephone 
service expanded, this simple approach became 
unsuitable and it became necessary to store incoming 
digits for faster and more economical interpretation. 
The first digit translators were electromechanical 
and were made of small groups of relay circuits 
known as “decoders”. These decoders changed 
the input information (dialed digits) into a form 
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usable by the newer switchers. This illustrates 
the translation function which, by definition, is 
the changing of information from one form 
to another. Translators were first used in this 
capacity in common control switchers such as 
panel and crossbar. But with the advent of stored 
program control, the translation function was 
greatly expanded. In the No. 1 ESS, the translators 
were administered by a program simply called the 
“translation program”. However, with advancements 
in programming techniques, the translation program 
has been replaced by a translation subsystem, 
made of many PIDENTS. This translation subsystem 
is used in both the No. 1 and No. 1A ESSs, giving 
these systems even broader capabilities. 


SUBSYSTEM DESCRIPTION 


2.02 The translation subsystem is a collection of 

routines that provide specific kinds of 
translation information at the request of other 
programs. Other programs which use the services 
of the translation subsystem are called clients of 
the translation subsystem. When a client requires 
translation data, the client supplies the necessary 
input data. The specific areas of main memory 
(program store and call store for No. 1 ESS and 
unduplicated call store for No. 1A ESS) are 
interrogated like a dictionary by the translation 
subsystem. The translation data is found, put into 
a standard form, and stored at a specific location 
for the client’s use. See PK-1A120, the Translation 
User’s Manual, for details on standard forms and 
locations. 


2.03 Figure 1 highlights the role of the translation 
subsystem. Translation data can be grouped 
into three types: 


(1) Addresses of equipment numbers 
(2) Numerical quantities and call processing data 
(3) Special data output. 
2.04 Addresses of equipment numbers are required 
by client programs for specific jobs such as: 
operating a relay, using a central pulse distributor 
or a signal distributor, reading a line or trunk scan 
point, etc. 
2.05 Numerical quantities specify directory numbers, 


trunk group numbers, billing indexes, ete. 
These types of quantities have the same number 
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TABLE A 


TRANSLATION SUBSYSTEM PIDENTS 


PIDENT 


LINE AND JUNCTOR TRANSLATIONS 


Junctor Translations 


Basic Digit Analysis and Conversion 


Basic Line and Directory Number 


Centrex Digit Analysis 


Centrex Line and Directory Number 


Line Cutover 


Multiline Hunt Arrangements 


TRUNK TRANSLATIONS 


Basic Trunk 
Universal Subroutines 


Centrex Trunk 


TRANSLATION DATA VERIFICATION 
MESSAGE PROGRAMS 


TVBD 
TVBL 
TVBT 
TVCD 
TVCL 
TVMN 
TRANCOMN 


Basic Digit Analysis 


Basic Trunk 
Centrex Digit Analysis 
Centrex Line 


Main Control Program 


of bits in all offices but may lead to different 
actions in each office. Call processing data has 
fixed numerical quantities which have the same 
meaning in all offices. Originating and terminating 
major classes are examples of call processing data. 


2.06 Special output data is the result of special 

conditions of the system. Cutover, growth, 
and higher level interrupts are examples of when 
the translation subsystem may yield special 
information. 
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Basic Line and Directory Number 


1A Processor Unit Translations 





BASE LEVEL PROCESSING 


2.07. The No. 1A ESS generic program is designed 

primarily to handle the call processing 
requirements of an office and to provide for other 
operational, maintenance, and recovery functions. 
In the absence of interrupts, the system operates 
on the base or L level. Base level processing is 
composed of frequency classes A through E and 
interject. (See Fig. 2.) The executive control main 
program (ECMP) schedules these classes of jobs 
to be performed at a predetermined time. 
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MAIN 
MEMORY 


ADDRESSES 
OF EQUIPMENT 
NUMBERS 


NUMERICAL 
QUANTITIES AND 
CALL PROCESSING 

DATA 


SPECIAL 
DATA 
OUTPUT 





Fig. 1—System Level Interface 


2.08 The translation subsystem is used by client 
programs as the clients require information 
for continued operation. This makes the scheduled 
use of the translation subsystem impossible. 
However, the translation subsystem does interact 
with base level processing by printing messages to 
verify changes in the translation data base. 


2.09 The No. 1A ESS translation routines interface 
with the outside environment via the 
input/output (I/O) subsystem. This subsystem 
handles the input messages received into the 1A 
processor I/O subsystem and passes the service 
request to the appropriate program (see Table A). 
When a class E job is entered by ECMP, the 
message is processed by the No. 1A ESS application 
software (ie, not 1A processor software). 


2.10 Output messages are processed in response 

to an input message, or they are generated 
internally by a client program. The No. 1A ESS 
application software formats and generates the 
message data for output and gives control to the 
1A Processor I/O subsystem. When another class E 
job is entered by ECMP, the message is sent to a 
designated I/O terminal. For complete details of 
I/O processing for No. 1A ESS, refer to Section 
231-310-265. 


GENERAL TRANSLATION SEQUENCE 


2.11 Unfortunately, not all translation routines 

follow a set pattern when deriving information 
from main memory. Many routines use the actions 
of other routines in order to avoid redundant 
programming. However, a general sequence of 
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Fig. 2—No. 1A ESS Control Software 
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events can be described for most translation routines. 


Figure 3 shows a simplified view of a TNN-PEN 
translation. 


RECENT CHANGE AND TRANSLATION DATA (NO. 1A 
ESS) 


2.12 Unlike No. 1 ESS, which stores translation 

data on read-only magnetic memory cards 
in program store and saves recent change (RC) 
data in a call store buffer called the RC area, the 
No. 1A ESS stores its translation data in writeable 
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unduplicated call stores and uses all RC information 
to directly make all RCs immediately effective. 
Thus, in No. 1A ESS, there is no primary 
RC area, no primary RC-hunting, and no 
memory card writing procedures as there 
is in No. 1 ESS. In some cases (such as 
customer changeable speed calling and customer 
activated call forwarding) customer dialing provides 
the input. There are three kinds of recent changes 
in No. 1A ESS: 


(1) Permanent 












NO 
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TRANSLATION 
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READ PRIMARY 









MAIN MEMORY 



















TO CLIENT PROGRAM (DCNT) 


Fig. 3—Simplified Translation Routines for No. 1A ESS 
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(2) Temporary 
(3) Delayed. 
A. Permanent 


2.13 Permanent RCs result in a direct overwrite, 

addition to, or deletion from translation data 
in call store, as well as the two disk backup copies. 
A rollback block is created for each permanent 
RC and stored on disk file in the rollback area. 
This rollback information is needed in case it 
becomes necessary to remove the RC. The rollback 
block associated with a permanent RC message 
contains the address and the old contents of every 
translation word overwritten or in any way altered 
as a result of the RC. 


B. Temporary 


2.14 Temporary RCs (such as call forwarding, 

service observing, plugup) are stored in a 
special buffer in the translations call store area 
called the temporary RC area. A temporary RC 
on a subtranslator primary translation word exists 
as one or more three-word entries in the temporary 
RC area, linked together and pointed to from the 
subtranslator primary translation word (PTW). 
Each three-word temporary RC entry except the 
last in the chain contains: 


e A back pointer 
e A temporary data primary translation word 


e A forward pointer (to the next temporary 
entry). 


The last entry on the chain contains the permanent 
PTW instead of a forward pointer. Temporary 
RCs do not generate rollback information. 


C. Delayed 


2.15 An RC order with delayed status is entered 

by an RC message that specifies DELAY. 
The message is stored on disk in the delayed 
RC area. Activation is accomplished by a 
separate RC message using the teletypewriter 
(TTY), or by keying certain digits into the ESS 
from a telephone set assigned a special class of 
service for RC delayed order activation. Activating 
a delayed RC has the same effect as entering the 
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same message via a TTY except without the 
DELAY specified. 


3. TRANSLATION SUBSYSTEM ROUTINES 
LINE TRANSLATIONS’ 


3.01 Line translations are basically concerned with 

data associated with line equipment numbers 
(LENs) and directory numbers (DNs). The LEN 
translation provides originating information about 
the calling customer’s line. The DN translation 
provides terminating information about the called 
DN. 


3.02 An LEN translation is called after a 

service request to provide information that 
establishes the next logical action to be performed 
on the call. The LEN translation must provide 
the class of service and the DN of the originating 
line as well as the following information: 


(a) Identity of any special initial actions required. 

A manual originating line must be routed 
to an operator while a denied line is not connected 
to anything. 


(b) Special characteristics of the line equipment. 

A line with a TOUCH-TONE® set must be 
connected to a TOUCH-TONE digit receiver, 
etc. 


(c) Recognition of complaint or service observing. 

If a line is on complaint or service observing, 
a number of special connections and special actions 
must be performed. 


(d) Custom calling features associated with the 
line, whether or not the line has a speed 
calling list, three-way calling, and call forwarding. 


(e) Identity of centrex group number for centrex 
service. This identification determines to 
which centrex group the line belongs. 


(f) Identity of the chart class column for 

screening purposes. This identification 
determines the routing and charging treatment 
to be given to the line originating the call. 


3.03 A DN translation is made on a terminating 

call to furnish the terminating class of 
service, the LEN, the type of ringing required, 
the indication of the privileges associated with the 
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terminating party, the type of hunting required 
for an idle line, and the alternate DN if the call 
is to be transferred. 


3.04 In general, the LEN or the DN translation 
sequence contains the following steps: 


(a) The client program supplies the input 
parameter. 


(b) The program store address of the PTW is 
derived. 


(c) A temporary RC hunt is performed. 


(d) The PTW is read and interpreted. If there 
is an auxiliary address, the translation 
words (TWs) in the auxiliary address are read. 


(e) The output information is stored for use by 

the client program. Different situations 
encountered result in the selection of different 
return addresses to the client program. 


3.05 All customer lines have line link network 

appearances and class-of-service translation 
memory information associated with them. Normally, 
this information is stored in the translation area 
of the unduplicated call store as a line class code. 


3.06 The classes of service provide types of 

information that identify privileges, restrictions, 
and call processing associated with a customer’s 
line. The following three basic types of information 
make up a customer’s class of service. 


(1) Major Class: This class includes any 
special originating and terminating actions 
required for a particular line or a DN. The 
major class is divided into originating and 
terminating major classes. These latter two 
classes are basically independent of each other 
[except in multiline hunting (MLH) and 
hotel-motel service] in system operation. 


(2) Equipment and Special Feature Class 

Options: These options indicate equipment 
classes and feature classes that a particular line 
may be given during originating and terminating 
actions. 


(3) Chart Class: This class prescribes the 
routing and charging aspects for a particular 
line. 
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Note: The originating and terminating major 
classes and the equipment and special feature 
class options are documented in the Translations 
Guide TG-1A, Volume I, Division 3. 


LEN TRANSLATIONS 


3.07. The input parameter for the LEN translation 

is the LEN. The outputs of the LEN 
translation are the DN (a numeric quantity) and 
the originating class-of-service information (a 
combination of generic information and numeric 
quantity). 


3.08 The DN is used for call charging purposes. 
The generic part of the originating 
class-of-service information consists of an originating 
major class and a group of bits representing the 
presence or the absence of some particular equipment 
or feature (TOUCH-TONE telephone, rotary dial 
telephone, dial conference, etc). The originating 
major class is the same in all offices and represents 
one of the mutually exclusive categories, such as 
individual line, 2-party line, coin line, ete. 


3.09 The originating class-of-service information 

occupies two TWs called the LEN class 
word 1 (LENCL 1) and the LEN class 
word 2 (LENCL 2). The most frequently 
occurring combinations of the LENCL 1 and LENCL 2 
may be represented by an abbreviated class code. 
Using the abbreviated class code as an index into 
the originating class expansion table, the translation 
program finds the expanded class words LENCL 1 
and LENCL 2. If an abbreviated class code does 
not exist for a particular class of service, the 
expanded class words LENCL 1 and LENCL 2 
appear in the auxiliary block for this LEN. The 
originating class expansion table is composed of 
groupings of LENCL 1 and LENCL 2. The use 
of the abbreviated class code makes it possible to 
store originating information in a LEN PTW located 
in an LEN subtranslator. Therefore, all customers 
with the same equipment and feature options require 
only one PTW. 


3.10 The information associated with an LEN as 

an initial address forms a file of variable 
length. A DN is always associated with the LEN 
either directly or indirectly through a multiline 
hunt group (MLHG) number. Depending on the 
class of service of the LEN, there may be sleeve 
lead information, an abbreviated dial list, or a 
transfer list. 
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3.11 Several translation sequences are based 

directly or indirectly on the LEN as the 
input parameter. They are the originating class 
and automatic message accounting (AMA) translation, 
the party line translation, and the disconnect 
translation. The party line translation is performed 
using information supplied by the originating class 
and AMA translation. 


3.12 The translation of the input parameter into 

the PTW includes an unconditional recent 
change hunt. In most instances, the translation is 
immediately completed after furnishing the client 
program with the class words, the DN word, and 
the auxiliary address (if any). In some instances, 
the translation is continued either immediately or 
after a return to the client program. 


DN TRANSLATIONS 


3.13 The input parameter for the DN translation 

is the DN of the called party. The output 
information of the DN translation provides the 
terminating class-of-service information and the 
equipment location of the called DN. The equipment 
location may be either an LEN or a route index. 
If the equipment location is a route index, the route 
index routes the call. By the use of four separate 
route indexes, the ESS provides considerable 
flexibility in the handling of calls for nonworking 
DNs. The route index categories are temporary 
disconnect, changed number, unassigned number, 
and blank number. Each route index may be 
arranged to terminate on an individual trunk group, 
or one or more indexes may be combined on a 
common group. 


3.14 The object of the DN translation is to find 

the equipment location of a line associated 
with the called intraoffice number and to provide 
any special information necessary to complete a 
call to such a line. The translation subsystem 
checks the busy/idle bit associated with the called 
line and, if it is idle, marks it busy. If the line 
associated with the called DN is busy and if the 
line has the series completion feature, the translation 
subsystem makes a translation for the next DN in 
the series. If the called DN has the call transfer 
service in effect, calls are transferred to the remote 
DN. If the remote DN is not in the local office, 
the output is simply the interoffice number to 
which the call is to be transferred. 


TRUNK TRANSLATIONS 


3.15 Trunk translation is defined as the means 

for converting known trunk data into coded 
information that can be recognized and used by 
the central processing equipment. This coded 
information is stored in the main memory and is 
retrieved by the system whenever the information 
is needed. 


3.16 Trunk translation data is required by the 
system for the following purposes: 


e To identify a trunk group associated with a 
given trunk network termination 


e To locate an idle trunk within a given trunk 
group 


e To seize and disconnect a trunk circuit 


e To update trunk group records (busy-idle 
status) in a call store and for various 
maintenance operations. 


3.17. Known trunk data consists primarily of the 

information used for ordering trunk equipment, 
the wiring terminations and switches involved in 
establishing paths through the trunk link networks, 
and the various options and services provided by 
the various trunk groups. A trunk group is a 
number of trunks all having the same origin and 
destination, type of pulsing, and type of circuit, 
except for digital carrier trunks which may use a 
variety of pulsing methods and trunk circuits. 
Otherwise, any trunk in a given group may be 
treated by the data processing system exactly the 
same as any other trunk in the group. 


3.18 Trunk translations are divided into two main 

categories corresponding to the universal 
and miscellaneous trunks. Universal trunk circuits 
are related in a fixed manner to the scan points 
and signal distributor (SD) points. These points 
are defined by the plug-in location of the package 
on the universal trunk frame. Miscellaneous trunk 
and service circuits are controlled by the master 
scanner, SD, and central pulse distributor (CPD) 
points. There are no fixed relationships between 
the plug-in packages and the miscellaneous trunk 
and service circuits. Translations are required to 
find the points necessary for controlling a particular 
circuit in the miscellaneous trunk frame. For this 
reason, universal trunk translations are relatively 
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simple as compared with miscellaneous trunk 
translations. 


A. Universal Trunk Translations 


3.19 A trunk distributing frame allows any universal 

trunk circuit to be connected to any position 
in the switching network. This connection requires 
that the processing program be able to associate 
trunk equipment locations with trunk network 
numbers (TNNs) and to know which trunks belong 
to which trunk group. Since all trunks in a trunk 
group are identical, any idle trunk in the group 
may be seized. 


3.20 Since one of the requirements of a universal 

trunk is that it contains only SD controlled 
relays, a trunk scanner number implies that it is 
a trunk SD number. Universal trunk circuits do 
not have CPD points. Translations must be made 
from the trunk scanner number to the TNN and 
vice versa. The trunk scanner number is the 
source of information concerning a seizure or 
disconnect. The TNN must be obtained in order 
to set up a connection to this trunk circuit. A 
translation from the TNN to the trunk scanner 
and SD numbers is required in order to operate 
the trunk circuit relays when a particular trunk is 
seized as a result of a hunt based on TNNs. A 
translation from the TNN to the trunk group 
number (TGN) is required since the administration 
of available trunks within a group is made on the 
basis of the TGN. The processing program must 
be able to find the class of any trunk. This 
processing is done most conveniently with a 
translation from the TGN to trunk class code and 
from the TNN to trunk class code. 


3.21. Other translation functions associated with 

trunks include the hunt for an idle trunk. 
In the case of the directory number translation, it 
is convenient for the translation subsystem to make 
the busy check because the translation subsystem 
has all necessary equipment numbers already 
generated. It is equally convenient for a translation 
function to make the hunt for an idle trunk and 
to make such a trunk busy, to hunt for an outgoing 
transmitter associated with a particular trunk, to 
hunt for an idle terminal in a conference trunk, 
and to restore trunks in memory to the idle state 
after a disconnect or after the discovery of a 
blockage in the network. 
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B. Miscellaneous Trunk Translations 


3.22 Miscellaneous trunk translations are significantly 

different from universal trunk translations 
because the miscellaneous trunk and service circuits 
are controlled by the master scaner, SD, and CPD. 
There are no fixed relationships between these 
plug-in units and the locations of the circuits on 
the miscellaneous trunk frame. 


3.23 Miscellaneous trunk circuits require the same 
basic translations as universal trunk circuits 
with the following additions: 


(a) Since the master scanner is used for 

miscellaneous trunk circuits, it is necessary 
to substitute a master scanner to TNN translation 
and vice versa for the original trunk scanner 
number to TNN translation. 


(b) Because the miscellaneous trunks and service 

circuits are controlled from SD and CPD 
points which have no relation to the master 
scanner number, a translation is required to find 
the SD and CPD numbers necessary for controiling 
a particular trunk circuit. 


3.24 A portion of the translation memory for 

the trunk and service circuits consists of 
special constants referred to as the supervisory 
program index (SPI) and the trunk program index 
(TPI) values. These constants are stored in the 
appropriate scanner-to-TNN translation tables. The 
values stored in memory depend upon the scan 
point function and the function of the trunk and 
must be updated when trunk equipment or translation 
changes are made. 


ROUTING AND CHARGING TRANSLATIONS 


3.25 The purpose of the routing and charging 

translations is to make it possible for a 3- 
or 6-digit translation to function in any central 
office by providing in a standard form information 
specific to this office concerning lines, access codes, 
area codes, office codes, routing and charging 
procedures, ete. 


3.26 The information entered in main memory 

provides data for all routing and charging 
translations. This data is for all classes of service 
to all subscriber dialed points including operator 
and other miscellaneous calls. All combinations of 
digits must have matching translations for a 3- or 
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6-digit translation served by a particular No. 1A 
ESS office. 


3.27. From an input-output point of view, the 
first three digits (six digits only if first three 
digits indicate that a 6-digit translation is needed) 
are dialed; full routing and charging information 
is supplied. A number of translations take place 
internally before the final results are given. 


3.28 A special characteristic of routing and charging 

translations is that the translation depends 
not only on which number was dialed but also on 
the services provided the customer who dialed it. 
The chart column of the originating customer has 
an effect on the routing and charging. For 
example, a customer whose toll calls are denied 
has a different route when trying to dial a toll 
call from that of a regular individual service 
customer. 


A. Normalized Office Code and Number Group 
Number Tables 


3.29 Of the seven digits of a DN, the first, 

second, third, and fourth digits are used to 
perform the conversion of the normalized code to 
the number group number (NOGR). The first, 
second, and third digits of the office code correspond 
directly to a normalized office code (NOC). After 
the NOC is found, it is multiplied by 10 and the 
fourth digit is added to it. This value is then 
translated by the NOGR table (one of two tables 
addressed by the same master head table word) 
into a 7-bit NOGR. The first ten words of this 
7-bit table are not used because the NOC cannot 
be zero. The NOC table expands the NOGR into 
digits 1 through 4. 


B. Rate Center Table 


3.30 The number group number to rate center 

(RAC) translation consists of a table storing 
for each NOGR, the rate center, a route index (if 
required), and cutover data for use of the cutover 
program. The NOGR indexes a selected rate center 
number within the rate center table. The rate 
center number is used as a selector in a 3-digit 
translator. 


C. 3-/6-Digit Code Translation 


3.31 The 3-digit code translation is performed 
with the first three digits used as the index 
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and the rate center number as the selector. If 
the first three digits represent an area code, the 
translation enters into a 6-digit sequence specified 
by a foreign area translator (FAT) number used 
as a second selector and the next three digits as 
the index. The three office code digits or the three 
area code digits provide routing and call type 
information for all chart classes provided in an 
office. 


3.32. The selector chooses a subtranslator. If 
the particular No. 1A ESS has only one rate 
center number, it is always 00. If more than one 
rate center number is served, each subtranslator 
is numbered sequentially. For example, a No. 1A 
ESS office may have two rate centers and three 
FATs that would be numbered 00, 01 (for rate 
centers) and 02, 03, 04 (for FATs). Each of the 
numbers is used to select a subtranslator (00 
through 31) within the head table. The D1, D2, 
D3 or D4, D5, Dé dialed digits (office code or area 
code) index a route pattern word containing a route 
pattern number within a selected subtranslator. 


D. Rate and Rovte Pattern Translator 


3.33 The route pattern number is translated into 

routing and charging information. Its seven 
most significant bits represent the selector that 
may choose a route pattern expansion table or a 
conflict table. A 1 in the sign bit of any head 
table word will be used to indicate a conflict table 
rather than a route pattern expansion table. The 
seven least significant bits of the route pattern 
number are the index portion. They index one of 
the 128 PTWs within a route pattern expansion 
table or one of 128 two-word entries within a 
conflict table. 


MISCELLANEOUS TRANSLATIONS 
A. Master Scanner Number Translations 


3.34 The master scanner number translator consists 

of a head table and a subtranslator for each 
master scanner frame. The subtranslator has 1024 
PTWs, one for every scan point on the frame. 
The scan points are either trunk or miscellaneous 
scan points. The PTW for a trunk scan point 
contains the trunk network number and a trunk 
program index. The data for a miscellaneous scan 
point consists of a unit type, a member number, 
a nontrunk program index, and sometimes associated 
data (random make-busy key number, stop hunt 
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number, etc). If there is associated data or if 
the member number exceeds 127, a 2-word auxiliary 
block is required. 


B. Unit Type Translations 


3.35 Equipment that is not identified by a 

network appearance (line equipment number 
or trunk network number) such as call stores, 
program stores, TTY, etc, is identified by a unit 
type number. Each item of the same unit type is 
given a member number. The unit type number 
translator has a subtranslator for every unit type 
number. The head table for this translator, 64 
words long, is in the fixed location table. The 
unit type table lengths, a second 64-word table in 
the fixed location table, specify the length of the 
subtranslators for each unit type. The subtranslators 
are built to ultimate size, one PTW for every 
member number planned. The PTW is an auxiliary 
address referenced to an auxiliary block or is all 
zeros if the member number is unassigned. 


C. Universal Service Order Code Translations 


3.36 The universal service order code translator, 

also called the line class code (LCC) 
table, contains information associated with the 
LCCs. The LCCs classify or identify a customer’s 
class of service relating to billing. 


D. Central Pulse Distributor Translations 


3.37. The central pulse distributor translator 
contains information associated with the unit 
type and member number. The translator relates 
the unipolar central pulse distributor points to a 
unit type and a member number. Central pulse 
distributor translations actually provide parameter-type 
data. For this reason, no recent change hunt is 
performed when these translations are executed. 


4. TRANSLATION SUBSYSTEM PIDENTS 
PIDENT NEJR 


4.01 The Junctor translations PIDENT (NEJR) 

has seven global entry points. Two of the 
seven (NEJQJ2, NEJTJ2) are used to translate 
junctor network number 1 (JNN1) to JNN2, depending 
on whether the JNN1 is assigned to a line link 
network (LLN) or a trunk link network (TLN). 
Three more global entries (NEJLJG, NEJTJG, 
NEJGJL) are used as temporary tieoffs to provide 
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for the elimination of partial equipping generic logic 
(9GNTWK). Two other global entries (NEJSNN, 
NEJLJ2) are used by the auxiliary test program. 
NEJSNN will translate a junctor scanner number 
(JSN) to a JNN and a trunk scanner number (TSN) 
to a trunk network number (TNN) or a service 
link network number (SNN). NEJLJ2 will translate 
TNNI1 to a TNN2 and a JNN2. Also, the NEJLJ2 
will translate the JNN2 to a JNN1. Finally, global 
entry point NEJNNS will translate a JNN to a 
JSN and will also translate either a TNN or a 
SNN to a TSN. 


PIDENT TRBD 


4.02 Translation routines for basic digit analysis 
and conversion (TRBD) are functionally 
grouped into nine parts within the PIDENT. 


A. Rate and Route Translations 


4.03 TRBD contains global entries to derive routing 

information, charging information, call types, 
prefix and timing information, the calling line’s 
chart column (CCOL), number group (NOG), and 
RAC for the following activities: 


e Toll 3-/6-digit analysis 
e Toll digit-by-digit analysis 


e Plain old telephone service (POTS) non-NXX 
codes 


e POTS foreign area (6-digit) analysis 
e POTS 3-digit analysis. 
B. Digit Conversion Routines 


4.04 The 1A processor, by design, must use 

numbers in binary form. For this, and 
other reasons, many conversion routines exist to 
convert binary coded decimal (BCD) numbers to 
binary numbers. Also, special conditions will arise 
when it is necessary to divide and convert numbers 
to other forms in order for information to be derived 
through product and insertion masking operations. 


C. International Direct Distance Dialing (IDDD) Code 
Translations 


4.05 Given one, two, or three digits of a country 
code, the final data may be extracted from 
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the IDDD translator. The digits are stored in call 
store locations (see PK-1A120), and program control 
is given to global TRIDDD. The routines that 
follow include rate and route translations and digit 
conversion routines in order to find the final data. 


D. Tandem Digit Interpretation 


4.06 The tandem digit interpretation routine will 

find the final data from the tandem translator. 
Program actions follow the same general flow as 
shown in Fig. 3. Initial entry is made at global 
TRTNDR. If no hunt of the temporary RC area 
is required, program flow will branch at global 
TRTAND. 


E. Speed Calling Digit Interpretation 
4.07 The speed calling digit interpretation routine 
has global entries for 2-digit speed calling 

(TRSC2D) and 1-digit speed calling (TRSC1D). At 
these entries, a check is made for valid digits 
dialed. If valid, the LEN PTW is used to examine 
LENCL words 1, 2, and 8, which contain the major 
class. The major class is used to transfer to the 
appropriate leg of program execution through the 
major class vector table resident in TRBD. Major 
classes which provide for speed calling include: 

e Individual line 

e Two-party lines 

e Multiline hunt group A 

e Multiline hunt group B 

e Hotel multiline hunt groups A and B 

e Hotel individual 

e Centrex manual line 


e Network access line—intrastate 


e Network access line with centrex interstate 
and intrastate. 


4.08 The last four parts of TRBD contain code, 
included in segments, for feature packages 


which are optionally activated per office. They 
are: 


e TOUCH-TONE Key Signaling 
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e Coin Line Activity Monitoring 


e Enhanced Private Switching Communication 
Service 


e Advanced Communication Service. 
PIDENT TRBL 


4.09 The translation routines for basic line and 
c directory number (TRBL) are a collection 
of subroutines designed to extract information from 
the directory number translator and the LEN 
translator. TRBL can be divided into five parts. 


4.10 The purpose of DN translations is to provide 
data specifying how to correctly terminate 
a call. Terminating class data includes: 


(a) The major class, which puts the DN in one 
of the mutually exclusive categories. It is 
used to select the program branch for the 
appropriate category. The TG-1A, Volume 3 
provides an explanation of each major class. 


(b) Line data comprised of: 


(1) Single bits, which indicate the existence 

or nonexistence of certain features or 
equipment, such as series completion, add-on, 
call waiting, etc. 


(2) Ring code 


(3) Disconnect guide, which specifies the actions 
necessary at disconnect time. 


(c) Trunk data, consisting of a route index if 
the DN is associated with a trunk group. 


A. Directory Number Entry Points 


4.11. The input parameter to the DN translator 

is the DN. The DN consists of a 3-digit 
code (representing a 2-digit NOC) and a 4-digit DN 
numeric or a standard 17-bit binary code. TRBL 
will be entered at different globals, depending upon 
which form the DN is received in. If the DN is 
received in the format specifing the NOC plus 
digits 4, 5, 6, and 7 in binary coded decimal, then 
entry is made at global TRDNXN. If the DN is 
received in standard binary form, then entry is 
made at global TRBINA. In some cases, the PTW 
of the DN has already been extracted from the 
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DN subtranslator, and in this case, entry is made 
to TRBL at global TRDNPW. 


B. Main Leg 


4.12 The main leg of TRBL is concerned with 

indexing into the subtranslators, auxiliary 
blocks, and expansion tables in order to find the 
final data. This indexing is clearly shown in 
PA-6A002, Section 0000. 


4.13 Once the PTW is found, an expansion of 

the abbreviated code is performed if necessary. 
The final data is found and saved, and this data 
consists of the DN PTW, the LEN or route index 
or MLHG, which ever applies, and DN class words 
(DNCLs) 1 and 2. Then the terminating major 
class is extracted from DNCL 1 and used to transfer 
through the DN major class vector table to the 
correct program branch. 


C. DN Major Class Vector Table 


4.14 The DN major class vector table consists of 

transfers to locals within TRBL, depending 
upon the major class of the terminating line. 
Program action at these locals further examine 
the auxiliary blocks and expansion tables to derive 
all applicable data for correct termination. Table B 
shows the major classes and associated local routines. 


PIDENT TRCD 


4.15 The translation routines for centrex digit 
analysis (TRCD) are concerned with examining 
the centrex common block and associated digit 
interpreter tables and auxiliary blocks to find the 
final data. The input to the centrex translator is 
the LEN PTW (from a previous translation), the 
dialed digits, and the centrex number (CXTN). 


4.16 TRCD can be functionally divided into four 

parts. The first three parts make up the 
centrex translation routines, and the last part is 
concerned with flexible route selection. 


4.17 Centrex service is a feature independent of 
any special hardware because it is controlled 
by the translation subsystem. This requires digit 
interpretation beyond the 3-/6-digit analysis or DN 
translations for the many dialing patterns and 
routing instructions available in centrex service. 
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4.18 There are eight global entries to the prefix 

and extension digit interpretation routines. 
Their purpose is to inhibit special actions of the 
line during the translating and to set indicators 
prohibiting certain features. Program control is 
passed to the data type vector table (PAECC) to 
find the common block and digit interpreter tables. 
Starting with the first digit, each digit is interpreted 
through its digit interpreter table. If no final data 
is found and if another digit is available, the next 
digit dialed is interpreted through the next digit 
interpreter table and so on until the final data is 
found. This digit analysis is accomplished by 
indexing into vector tables with special numbers 
such as: 


e Data types 
e Subtypes 
e Sub-subtypes. 


Each time the specified vector table is indexed, 
program control is passed to locals within TRCD 
for further action in processing the call. Information 
yielded in this analysis provides both originating 
and terminating program actions. For further 
details on centrex call processing, see Section 
231-045-106. 


PIDENT TRCL 
4.19 The translation routines for the centrex line 
and directory number (TRCL) are routines 

in addition to those found in TRCD and TRBD. In 
addition to the major classes investigated in TRBD, 
TRCL has provisions for four more major classes. 
They are: 

e Attendant or listed directory number 

e Nondirect inward dialing 


e Semirestricted 


e Centrex range of unassigned directory 
numbers. 


4.20 TRCL contains routines to derive information 
used to administer a given centrex data 


link group. These include translations for: 


e Automatic call distribution (ACD) lamp groups 
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DNINTC 
DNSLLD 
DNTGF 
DNMLHCK 
DNBICK 
DNMLHA 
DNMLHB 
DNHMLHA 
DNHMLHB 
DNDCFO 
DNDCFI 
DNSBLO 
DNMCC 
DNRIDT2 
DNHOMO 
DNNDIDA 
DNNDIDB 


DNMDN 


TABLE B 


DN MAJOR CLASS VECTOR TABLE 


PIDENT TRBL 


MAJOR CLASS AND/OR TREATMENT 


Disconnected Number and Intercept 

Sleeve Lead 

Trunk Group or Trunk Group With Ringing 
Individual Line, Two-Party, Regular Coin 
Multiparty 

MLH Group A 

MLH Group B 


Hotel MLH Group A 


Hotel MLH Group B 


Call Forward to Interoffice DN 

Call Forward to Intraoffice DN 

Subscriber Line Overflow 

Master Control Center 

Denied Termination 

Hotel Individual 

MLH Group A Without Direct Inward Dialing 
MLH Group B Without Direct Inward Dialing 


Remote Call Forwarding 


e ACD ports and keys 
e Visual displays 
e ACD status displays. 
4.21. TRCL also contains miscellaneous routines 
based on LENs or DNs for centrex traffic 


purposes. 
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PIDENT TRLC 


4.22 The translation routines for line cutover 

(TRLC) are used at cutover and yield special 
output data needed at this time. TRLC contains 
six global entries. 


4.23, Global SAALTN is used by the automatic 
line insulation test program to check the 
activity of a DN, either precutover or post-cutover. 
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4.24 Global SAORIG is part of an LEN translation, 
used to determine if the active or inactive 


status of an LEN is in agreement with a given 
DN. 


4.25 Global SATERM is part of a DN translation, 

used to determine if the active or inactive 
status of the given DN agrees with the RAC, the 
alternate DN head table, or the DN exception list. 


4.26 Global TRLCGL is part of the line cutover 

audit and used to determine if the LEN or 
LENs associated with a given DN are part of a 
MLHG and their audit status. 


4.27, The cutover audit enters TRLC at global 

TRLCML to derive any other LENs associated 
with a given DN in a MLHG after the initial LEN 
has been found. 


4.28 Global TRLCDC is part of an LEN translation, 

used to determine the active or inactive 
status of the line and whether there is a sleeve 
lead associated with that line. 


PIDENT TRML 


4.29 The translation routines for multiline hunt 

arrangements (TRML) consist of routines to 
further translate the LENs and DNs associated 
with a MLHG. Global TRDNML is a common entry 
point from the DN translation for MLHG. Here 
the MLHG number and common block are found 
and DNCL 1 and DNCL 2 are extracted. DNCL 2 
contains the type of MLHG, and it is used to index 
the MLHG transfer vector table. Transfers are 
made to locals within TRML, depending on the 
MLHG type. They include: 


e Regular hunt 
e Uniform call distribution 
e Multiple position hunt 
e Preferential hunt 
e ACD hunt 
e Nonhunt. 
4.30 Global TRLNML is a common entry point 


from the LEN translation for MLHG. Program 
action will extract and store LENCLs 1, 2, and 3 
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and the billed DN for the MLHG. This information 
is stored for output, and a return is made to the 
client. 


4.31. Global TRLDML is a common entry point 

for the LEN disconnect translation. It is 
used to determine the terminal number from the 
input and save the activity bits, LENCLs 1, 2, 
and 3, and the main DN. This information is used 
in later routines to derive all the necessary actions 
for proper disconnect. 


4.32 TRML also contains a collection of routines, 
which are based on the MLHG translator. 
These routines will: 


e Find the main DN and last X_ numbers 


e Derive the address of the MLHG common 
block 


e Derive the address of the main (hunt) list 
head table 


e Derive the address of the preferential lists 
head table 


e Derive the program store (PS) address of 
the main or outdial list for X_ numbers 


e Extract temporary and permanent data for 
the main list word 


e Determine if the start hunt number is a 
terminal or nonterminal number 


e Extract the LEN main or outdial list for 
X_ number 


e Retrieve hunt list 


e Derive MLHG and terminal numbers from 
raw data. 


4.33. TRML will derive data for the administration 

of MLHG make-busy keys. This is accomplished 
by indexing into a transfer vector table with the 
key type. 


PIDENT TRBT 
4.34 The basic trunk translation routines (TRBT) 


are composed of trunk and _ peripheral 
equipment routines, route transfer routines, trunk 
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hunt and rehunt routines, trunk restore routines, 
and trunk idle list manipulation routines. 


A. Trunk and Peripheral Equipment Routines 


4.35 The trunk and peripheral equipment translation 
routines include: 


e TGN primary translator 
e TGN supplementary translator 


eTGN optional word for supplementary 
auxiliary blocks 


e TNN to peripheral equipment number (PEN) 
translator 


e TNN to TGN translator 
e Master scanner number translator 


e Universal trunk scanner number to TNN 
translator 


e Central pulse distributor number translator 
e Unit type to member number translator 
e Automatic trunk test table translator. 


These translation routines follow the general 
translation sequence of Fig. 3. The functions and 
final data found in these translators are explained 
in PA-6A002. 


B. Trunk Hunt and Restore Routines 


4.36 The object of these routines is to find an 

idle trunk in a group or to restore or update 
the busy/idle record of a trunk. This may be 
accomplished by regular trunk hunt routines that 
are given either a TGN or a route index. Global 
TRTGNH is entered when the TGN is known. 
Global TRTHDD is entered when the route index 
is given. These routines validate the information 
that is known about a trunk in order to correctly 
administer the busy/idle record and seize or restore 
the proper trunk. This includes a TGN range 
check, type of trunk (outgoing, two-way, multiport, 
etc.), alternate routing indicator check, queueing 
indicator check, and a check of whether the toll 
network protection is active. Given this kind of 
data, a transfer can be made to points in the main 
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leg of the trunk hunt and restore routines to find 
an idle trunk or update the busy/idle record. 


PIDENT TRCT 


4.37 The translation routines for centrex trunks 

(TRCT) are routines used to administer the 
trunk-busy lamps associated with centrex trunks. 
When the last trunk in a group is seized, the 
trunk-busy lamp is lighted for the attendant. 
Conversely, when the first idle trunk is restored 
to the group, the lamp is turned off. This is 
accomplished for one-way and two-way trunks by 
four global entries. Global TRLOF1 will examine 
the idle list of a one-way trunk group, and if idle 
trunks exist, subroutine CXTBOF in PIDENT CXIO 
is called to turn off the console lamp. If all 
one-way trunks in a group are busy, the global 
TRLON1 will call subroutine CTXBON in PIDENT 
CXIO to turn on the console lamp. Globals TRLOF2 
and TRLON2 take similar actions for two-way 
trunks. 


PIDENTS TRUR AND TRANCOMN 


4.38 Universal translation routines (TRUR) include 
routines for a recent change hunt of the 

temporary RC area and routines to assemble and 

store information for a TW02 output message. 


4.39 Common translators (TRANCOMN) are 

routines that are common to ESSs using 
the 1A processor. These routines will translate 
unit type numbers to member numbers for 1A 
processor units such as central controls, I/O unit 
controllers, I/O unit selectors, etc. 


TRANSLATION DATA VERIFICATION MESSAGE PIDENTS 


4.40 A translated printout of the stored translation 

data can be requested via the TTY so that 
its correctness can be verified. The input messages 
are described in the Input Message Manual IM-6A001, 
and the resulting output messages are described 
in the Output Message Manual OM-6A001. Figure 
4 shows the interface between the translation data 
verification message PIDENTS and the ESS I/O 
subsystem. 


PIDENT TVMN 
4.41 The translation data verification messages— main 


control program (TVMN) is a client program 
of the I/O application software. When the I/O 
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application software subsystem receives a request 
for translation data verification, a search is made 
of the TTY input messages directory and catalog 
(TTIA) for the correct client program. In this 
case TVMN will be selected. 


4.42. TVMN takes the necessary actions to verify 

the request as valid. TVMN sets the main 
program flag for ECMP to process the message 
at the appropriate time. TVMN has five client 
programs (Fig. 4), which search the translation 
data base for information required to build the 
output message. Relevant data for the output 
message is stored by the client programs in main 
memory locations which are specified in the 
Translation User’s Manual PK-1A120. 


4.43. TVMN also contains routines for general 
equipment number conversion for information 
associated with output message (OM) TRO3, to print 
primary recent change information for a program 
store word (TR34), to list available space in program 
store (TR13), and for detailed information on 
delayed activation blocks (TR50 and TR51). 


4.44 Clients of TVMN are responsible for gathering 

data for OMs and requesting the print 
routines. Tables C, D, E, F and G show the client 
programs and the messages associated with them. 


5. ABBREVIATIONS AND ACRONYMS 


ACD Automatic Call Distribution 

BCD Binary Coded Decimal 

CCIS Common Channel Interoffice 
Signaling 

CCOL Chart Column 

CFG Customer Facility Group 

CPD Central Pulse Distributor 

DCNT Dialing Connection Program 

DN Directory Number 

DNCL Directory Number Class Word 

ECMP Executive Control Main Program 

ESS Electronic Switching System 
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FAT 


IDDD 


1/0 


TGN 





Foreign Area Translator 


International Direct Distance 
Dialing 


Input/Output 

Junctor Network Number 
Junctor Scanner Number 
Line Class Code 

Line Equipment Number 


Line Equipment Number Class 
Word 


Line Link Network 

Multiline Hunting 

Multiline Hunt Group 
Normalized Office Code 

Number Group 

Number Group Number 

Plain Old Telephone Service 
Primary Translation Word 

Rate Center 

Recent Change 

Signal Distributor 

Simulated Facilities 

Simulated Facilities Group Number 
Service Network Number 
Supervisory Program Index a 
Software Subsystem Description 


Trunk Group Number 


Trunk Link Network 
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TNN 


TPI 


TSN 


TTY 


TW 
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TRO1 
TR20 
TRO3 
TR19 
TRO8 
TRO7 
TR48 
TRO6 
TR43 
TR64 
TR69 
TR15 
TR35 
TR47 
TRI6 
TR39 
TR41 
TR44 
TR45 
TR66 
TR7D+71 








ISS 1, SECTION 231-045-145 


TABLE C 


TRANSLATION DATA VERIFICATION MESSAGES 
PIDENT TVBL 


INFORMATION PRINTED OR FUNCTION 


All information pertaining to a DN 

Input DN and address of PTW 

All information pertaining to a LEN 

Input LEN and address of PTW 

DN, MLHG, and terminal number billed to the DN 

DN associated with a customer abbreviated dial list 

Input DN, the final data, and the level of interpretation 
Requested to deactivate temporary transfer when no transfer is active 
All DNs with active variable call forwarding 

Error detected in CFG 

Indicates verification is proceeding normally 

All information pertaining to a MLHG 

SFGN and SF auxiliary block 

Information pertaining to the multiline hunt or outdial terminal 
Hunting and outdial lists of a MLHG 

Preferential hunt list for MLHG terminal 

MLHG terminals assigned to given ACD mask block 

Alternate server pool number and associated auxiliary block 
Input coin DN and associated data 


Header portion of auxiliary block for a traffic group 


Emergency service number data 


Trunk Network Number 6. REFERENCES 


BELL SYSTEM PRACTICES 


Trunk Program Index 


SECTION TITLE 
Trunk Scanner Number 231-048-001 Basic Concepts of Translations 
231-012-101 Basic Concepts of Translations 
Teletypewriter 
231-070-410 Concepts of Translations 
Translation Word. 231-118-102 Line Translation Data 
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TABLE D sn 


TRANSLATION DATA VERIFICATION MESSAGES 
PIDENT TVBT 


INFORMATION PRINTED OR FUNCTION 


Trunk class code, route index, or charge index and program store address of an 
expansion block 
Information for route index expansion 


All information pertaining to a TNN 
All information pertaining to a TGN 


All information pertaining to a trunk circuit number 


All information pertaining to a master scanner number 
All information pertaining to a unit type number and member number 


All information pertaining to a junctor network number or junctor scan point 
number 


Input TNN and associated PTW 

Input master scanner number and associated PTW 

Input universal trunk circuit number and associated PTW 

Input junctor network number and associated PTW —, 
Input junctor scan point number and associated PTW 

Input unit type and member number and associated PTW 

Contents of AUTOVON trunk group number to TGN translator 

Format for all TNNs for nonusage trunk scanning 


Information from CCIS band subtranslator and related TNNs 


TABLE E 


TRANSLATION DATA VERIFICATION MESSAGES 
PIDENT TVCD 


! 
| messace | INFORMATION PRINTED OR FUNCTION 
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Centrex common block, excluding digit interpreter tables 
Centrex supplementary translator data 
Centrex digit interpreter tables to level requested or final data word 


Flexible route selection information 


Input console group number and address of the console group number head cell. 
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Translations / 1A ESS 





ISS 1, SECTION 231-045-145 


TABLE F 


TRANSLATION DATA VERIFICATION MESSAGES 
PIDENT TVBD 


INFORMATION PRINTED OR FUNCTION 


All routing and charging information associated with the input 3- or 6-digit code 
Input 3-digit office code and the program store address of the PTW 
Final data for a tandem group and the digits to interpret 


Routing information associated with a toll digit translation index and a chart 
column 


Input signal digit analysis number and associated auxiliary block information 





TABLE G 


TRANSLATION DATA VERIFICATION MESSAGE 
PIDENT TVCL 


} messace | INFORMATION PRINTED OR FUNCTION 


Format for information from status display translator 

Format for information from the remote data interface key signal translator 
Format for information from the remote data interface port translator 
Format above the visual display data 


Input CFG number and associated auxiliary block 


Centrex numbers assigned to directory numbers in a specific 1000’s group 





231-118-103 


231-118-104 


231-118-105 


231-310-265 


231-045-106 


Trunk Translation Data OTHER 

Routing and Charging Translations PD-1A120 Translation Program 

Miscellaneous Translation Data 

u PK-1A120 Translations User’s Manual 

Input/Output Application Software 

Call Processing-Centrex. PA-6A002 Translations Output Configuration. 
Page 23 
23 Pages 





24 





DMS-100 LGINCTRL 


LGINCTRL 





Table Name : Login Control Table 

Functional Description of Table LGINCTRL 

Table LGINCTRL enables the dump and restore of login control data. This capability allows for the 
preservation of data when software is upgraded. Table LGINCTRL is an extension of table 


TERMDEV and tuples can only be added or deleted from table LGINCTRL through table TERMDEV 
tuples. 


The optional Command Interpreter (Cl) command LOGINCONTROL is recommended to change 
tuples in table LGINCTRL. 


Datafill Sequence : Table TERMDEV must be datafilled before table LGINCTRL 


Table Size : 0 to 127 tuples 





Field Descriptions for Table LGINCTRL 



























































Field or 

Subfield Entry Explanation 

TERMDES alphanumeric Terminal Designation 

(up to 8 This field defines the name defined by the operating 
characters) company for each of the terminal types. All Trunk 

Test Positions (TTPs) must be assigned first, starting 
with the Maintenance and Administration Position (MAP) 
TTP:0, followed by the remaining TTPs in numerical 
order. After the TTPs are assigned, other terminal 
devices, such as printers and Video Display Units 
(VDU), can be assigned. 

DISTIME =1) to 32-767 Disabled Time 
This field defines the time, in seconds, that the 
terminal is disabled. 
Entries outside the range indicated are invalid. 
The default value is -1 (forever). 

MAXLOGIN 1 to 32767 Maximum Login Time 
This field defines the time, in seconds, that the 
user has to login before being disabled. 
Entries outside the range indicated are invalid. 
The default value is 60 (60 seconds). 

-continued- 
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DMS-100 LGINCTRL Control Table 








Field Descriptions for Table LGINCTRL (continued) 



































Field or 

Subfield Entry Explanation 

MAXIDLE =1 to 32:767 Maximum Idle Time 
This field defines the maximum idle time, in seconds, 
that the terminal can remain idle. 
Entries outside the range indicated are invalid. 
The default value is -1 (forever). 

MAXRETRY =1 “to 32767 Login Retries 
This field defines the number of tries available for 
login. 





Entries outside the range indicated are invalid. 


The default value is 4. 








Note: If the user tries to enter a value of less that -1 (minus one) for fields 
DISTIME, MAXLOGIN, MAXIDLE or MAXRETRY, it is aborted. As the login control increment 
is optional, some or all of these fields are not active in the load. Other fields are 
dependant on other optional features such as BC1043 (Automatic Dial Back). 

















DISABLON ALL Login Auto Disable Event 


This field defines the set of events that disable 
a terminal. 





* ALL (all conditions are in effect) 










































































LC_ * LC_DIALBACKCALLFAIL (modem dialback call failed) 
DIALBACK 

CALLFAIL 

LC_ * LC_DIALBACKLOGINFAIL (modem dialback login failed) 
DIALBACK 

LOGINFAIL 

iC_IDLE * LC_IDLETIMEOUT (terminal idle time-out) 

IMEOUT 

LC_ * LC_LOGONFAIL (logon failed) 

LOGONFAIL 

.C_LOGON * LC_LOGONTIMEOUT (logon time-out) 

IMEOUT 

.C_LOGOUT * LC_LOGOUT (user logged out) 

.C_OPEN * LC_OPEN_COND (open condition) 
_ COND 

ONE * NONE (no conditions are in effect) 

















—continued-— 
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DMS-100 LGINCTRL Control Table 








Field Descriptions for Table LGINCTRL (continued) 


Field or 
Subfield 





Entry 





Explanation 





FRCOUT 


Y or N 


Force-logged Out 
Y (yes) defines that a user is forced-logged out 
if the line is dropped. Otherwise, enter N (no). 


The default value is N. 





DIALBACK 


DB_OFF 
DB_ANSWER 
or DB_DIAL 





Dialback State 
This field defines the state of a modem with 
with dialback feature. 








Enter DB_OFF if the dialback feature is off. 
Enter DB_ANSWER if the dialback feature answers. 
Enter DB_DIAL if the dialback feature is in dial 
mode. 








The default value is DB_OFF. 





DIALTYPE 














HA 
Oo 
Zz 
irl 





Dial Type 
This field defines the type of dialing. 








Enter AUTO for automatic dialing, PULSE for 
pulse dialing, or TONE for tone dialing. 











4 
| 


he default is AUTO. 





NUMRINGS 


Number of Rings 
[This field defines the number of rings allowed 
before a modem call fails. 


4 





4 
| 


he default value is 7. 





NUMCALLS 


Number of Calls 
This field defines the number of calls allowed 
before the terminal device is disabled. 


4 





4 
1 








he default value is 1. 





—-End- 





Datafill Example : An example of datafill for table LGINCTRL is shown below. 





Datafill Example for Table LGINCTRL 





Example of a MAP display: 






































TERMDES DISTIME MAXLOGIN MAXIDLE MAXRETRY DISABLON 
FRCOUT DIALBACK DIALTYPE NUMRINGS NUMCALLS 

MAP =i 60 4 NONE 

N DB_OFF AUTO 7 1 
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DMS-100 TERMDEV 


TERMDEV 
Table Name : Terminal Device Table 
Data Forms: 2056 
Functional Description of Table TERMDEV 
Table TERMDEV lists the assignments for terminal devices. 


The operating company completes the input for table TERMDEV. The switching unit Input/Output 
Controller (IOC) assignments to the terminal devices are shown on Northern Telecom drawing 
number D610. 


See table MTD (Magnetic Tape Device) for the terminal devices that have fixed assignments on the 
lOC. 


Assign the Trunk Test Positions (TTP) devices in order: TTP:00, TTP:01, TTP:02 and so on, until all 
the TTP devices are assigned. Only then can the rest of the printers and Visual Display Units 
(VDU) be entered in the table. 


WARNING! Lockout Condition Can Occur. A lockout condition exists if all 
commands are set as privileged—classed (PRIVCLASS) out for all users and 
terminals. The only way out is to use the user identification (userid) ADMIN. An 
ADMIN userid is neither displayed nor restricted in any way. It is always available, 
provided the ADMIN password is known and the terminal is not in the automatic login 
(AUTOLOGIN) mode. 


If the DMS switch is under a heavy load, a number of terminals and one log device must continue to 
run despite the call processing or maintenance load. The base support is accomplished by having 
guaranteed background tasks. Guaranteed tasks are limited in number, so they run more frequently 
than other tasks. 


The following devices can be guaranteed. 


e One Network Management (NWM) Maintenance and Administration Position (MAP) or port. 
e One Switching Control Center System (SCCS) MAP. 

e One local MAP. 

e One service analysis position or interface. 

e One Emergency Technical Assistance Service (ETAS) reserved device. 

e One log device. 


In table TERMDEV no more than five devices can be guaranteed, and in table LOGDEV only one 
device can be guaranteed. These devices are assigned by the customer through datafill in tables 
TERMDEV and LOGDEV. Any user logging into any of these devices has a guaranteed response. 


Field GUAR is set to N (no) by default, and must be changed if this feature is to be used. 
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Note: Access to table TERMDEV can be restricted by datafilling table 
CUSTPROT. For operating companies in the United Kingdom, access to this table 
must be restricted by datafilling table CUSTPROT, to prevent the customer of third 
party system maintenance from reconfiguring terminal data and affecting automatic 
dial—back or terminal command class restrictions. 


If the switching unit contains feature ADO179 (ACD Real Time Display Enhancement), the datalink 
device must be datafilled in table TERMDEV and table SLLNKDEV in order to be connected in 
LNKUTIL and used to generate the ACDRTD (ACD Real Time Display) reports. 


If the switching unit contains feature package NTX243AA (AMA Teleprocessing System), table 
TERMDEV must be datafilled for each of the two recording devices in the Device Processing 
Peripheral (DPP) unit. TERMDEV must be datafilled for the DPP links before datafilling table 

DPP. For reliability, care must be taken to datafill terminals that are associated with different OCs. 


When datafilling table TERMDEV, table CUSTPROT, table SUBPROT, or table CMDS, do not use 
the same class number twice; the system does not distinguish between class numbers for 
commands and class numbers for system data table access privilege. As the PERMIT command is 
used to assign privilege classes for commands and for access to tables, accidental duplication of a 
class number can cause the PERMIT command to provide not only the intended access to a 
command, but also unintentional access to a table. 


If a change to table TERMDEV affects the terminal data used by table DPP, the affected tuple must 
be deleted from table DPP before deleting the tuple from table TERMDEV. 


Effective BCS30, with the 1X67FA device controller card for the Simplified Message Desk Interface 
(SMDI) feature, two C-side links enable outgoing messages sent from Central Control (CC) to the 
card to be received over C-side link 0 (zero). Outgoing messages sent from the card to the CC are 
routed over C-side link 1. 


With two C-side links, datafilling table TERMDEV with a console device using a 1X67FA terminal 
controller card requires two tuples. When the first tuple is added manually, a second tuple is added 
automatically by table control. 

There is a two-tuple restriction placed on field TERMDES when datafilling a console device using 
the 1X67FA terminal controller. In this instance, there is a maximum field length of seven 
characters. When the second tuple is added automatically, the second, unique tuple name takes 
the name of the first tuple, followed by the capital letter |. 


When datafilling table TERMDEV with a console device that does not use the 1X67FA card, the 
maximum length of a tuple name in field TERMDES is eight characters. 


For related information, refer to table MTD. 

Datafill Sequence : Table IOC must be datafilled before table TERMDEV 

Table Size 

Memory is automatically allocated for the maximum number of 128 terminal devices, which includes 


59 SMDI-type console devices and 64 non—SMDI devices; the remaining five entries are reserved 
for other uses. 
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Field Descriptions for Table TERMDEV 


Field or 
Subfield Entry 








Explanation 














TERMDES alphanumeric 
(up to 8 
characters) 





Terminal Designation 

This field defines the name defined by the operating 
company for each of the terminal types. All Trunk 
Test Positions (TITPs) must be assigned first, starting 
with the Maintenance and Administration Position (MAP) 
TTP:0, followed by the remaining TTPs in numerical 
order. After the TTPs are assigned, other terminal 
devices, such as printers and Video Display Units 
(VDU), can be assigned. 











Dial-up facilities used by ETAS as Field Service 
Engineering (FSE) should be named DIAL1, DIAL2, 
and so on. 








Note: Enter a maximum eight characters except 
if using the 1X67FA card, which requires seven 
characters. 





IOCNO 0 to 19 


Input/Output Controller Number 

Enter the number of the input/output controller to 
which the terminal device is assigned. See 

table MTD for details. 





CKTNO 0 to 35 


Input/Output Controller Circuit Number 

Enter the input/output controller circuit number 
to which the terminal device is assigned. See 
table MID for details. 











WW 





ERMTYPE CYB, 
DEFAULTC, 
DPH, FPRT, 
HAZ, HP, 
KSR, LGR2, 
LSG, PRT, 
SMDI, SPRT, 
EG, VELOO; 
VT102, or 
vuc4 


























Terminal Type 
Enter one of the following terminal types: 





CYB (Cybernex) 

DEFAULTC (does not support MAP) 

DPH (Displayphone) 

FPRT (Fast Printer (does not pad output lines 
Ww 

H. 

H 





+ F F 


ith nulls) ) 

AZ (Hazeltine) 

P (Hewlett-Packard) 

Keyboard Send/Receiver) 

LGR2 (Cybernex) 

GR2 LSG (Lear Sigler) 

RT (Printer (pads output line with 15 nulls)) 
DI (Simplified Message Desk Interface) 

PRT (Slow Printer (pads output line with 

0 nulls) ) 

EC ( EC) 

r100 
r102 
UC4 (Vucom) 





AN 
n 
ve) 














+ £ F£ + F F F FH 











=| 





7 








G¢adaqaHwWN WD 


+ £ F 


Note: Check printer operating manual for number 
of nulls required. 





-continued- 
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Field Descriptions for Table TERMDEV (continued) 
Field or 
Subfield Entry Explanation 
BAUDRT B110, Baud Rate 
B134PT5, Enter the baud rate of the terminal device. 
B150, B300, 
B600, B1200, 
B1800, 
B2000, 
B2400, 
B3600, 
B4800, 
B7200, 
B9600, or 
B19200 
INTYP CL or EIA Interface Type 
If the terminal device is equipped with a data 
set or modem, enter EIA (Electronic Industries 
Association interface). Otherwise, enter CL 
(Current Loop). 
EOQPEC alphanumeric Equipment Product Engineering Code 
(up to 8 Enter the Product Engineering Code (PEC) of the 
characters) terminal controller card. 
PRTY EVEN, ODD Parity 
or NONE Enter the parity of the terminal device. 
GUAR Y or N Guaranteed Device 
Enter Y (yes) if the device is guaranteed, that is, 
the device continues to run despite the call 
processing or maintenance load. Otherwise, 
enter N (no). 
The default value is N. 
MODEM CTS, DBANS, Modem Type 
NONE, The entry in this field describes the type of modem 
RIXON, that is connected to the corresponding port, and 
or UDS thus determines which set of procedures is used 
for controlling the modem. 
If enhanced password control (automatic dial-back) 
is present, the type of modem must be specified. 
If the feature is not present, the entry is NONE. 
Enter CTS if the CTS212AH modem is connected to 
the port. 
Enter DBANS if a modem is connected to the port but 
the modem has no agency procedures (the modem is 
capable of autoanswering but not autodialing). 
Enter RIXON if the Rixon R212A modem is connected 
to the port. 
Enter UDS if the Motorola UDS-224 is connected to 
the port. 
-continued- 
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Field Descriptions for Table TERMDEV (continued) 


Field or 


Subfield 


Entry 


Explanation 





COMCLASS 


0 to 30 
ONE 
or 

ALL 








Command Class 





device. 


Enter the command classes allowed for the terminal 
The command classes must be separated from 


each other by a blank space. 


Enter NONE if no 
terminal, or ALL 
commands for the 








A user logged in 


one is allowed any commands for the 
is there is no restriction for any 
terminal. 


at the terminal is permitted to 


execute only those commands that are allowed on 


the terminal and 


for the user's login identification. 





—-End- 





Datafill Example 


An example of datafill for table TERMDEV is shown below. The first tuple shows standard datafill 


on an unguaranteed MAP device. The second tuple shows datafill with a terminal ID for use in table 


DPP. 





Datafill Example for Table TERMDEV 





Example of a MAP display: 









































TERMDES IOCNO CKTNO TERMTYPE BAUDRT INTYP EOPEC PRTY GUAR MODEM 
COMCLASS 

MAP 0 8 VT100 B1200 CL 1X67AA NONE N NONE 
ALL 

DPP1LNK1 0 8 VT100 B1200 CL 1X67AA NONE N NONE 
ALL 
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DMS-100 MWDATA 


MWDATA 
Table Name : Milliwatt Data Table 
Data Forms: 2169 
Functional Description of Table MWDATA 


Table MWDATA provides different milliwatt (mW) values that are required for the office. Up to ten 
different milliwatt values (level in decibels (dB) and frequency in Hertz (Hz)) can be preset. Table 
MWDATA is used by the office whenever a milliwatt reference value is required. The table is 
indexed by a milliwatt index number provided by table CLLIMTCE. 


The milliwatt level is selected on a trunk group basis. Table MWDATA may be modified using 
standard table control aspects. The milliwatt values in positions 1 to 9 (field IDXKEY) can be 
added, changed, and deleted as required. The value in position 0 (zero) cannot be deleted, but it 
can be changed. Position 0 must always contain the standard milliwatt value for the office. 


For a given cp_id of acircuit, the milliwatt level and frequency fields are updated. The system 
indicates whether the information is valid. If the information is not valid, the standard milliwatt value 
is assigned for the office is used. The standard value is always assigned to position 0 in table 
MWDATA. Note: Position 0 (field IDXKEY) in table MWDATA must always be datafilled. 

Datafill Sequence : There is no requirement to datafill other tables prior to table MWDATA. 


Table Size : 1 to 10 tuples 





Field Descriptions for Table MWDATA 


Field or 
Subfield Entry Explanation 








IDXKEY 0 to 9 Milliwatt Index Key 

Enter the milliwatt (mW) index. This field is the 
key to the table. The index 0 (zero) must always 
be datafilled. Index 0 cannot be deleted, but the 
values in field MWDATA can be modified. All other 
indices can be added, changed, or deleted. 














MWDATA see subfields Milliwatt Data 
This field consists of subfields LEVEL and FREQ. 


























LEVEL -1000 to 1000 Decibel Level 
Enter the decibel leve in 0.1 dB steps. An entry 
of 10 is equal to a decibel gain of 1 dB and an 
entry of -10 is equal to a loss of 1 dB. 

















Note: Values against index 0 can only be 
changed. 





—continued-— 
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Field Descriptions for Table MWDATA (continued) 

















Field or 

Subfield Entry Explanation 

FREQ 0 to 16000 Milliwatt Frequency 
Enter the milliwatt frequency in Hertz. 
Any entry outside the range indicated for this 
field is invalid. 
Note: Values against index 0 can only be 
changed. 

-End- 





Datafill Example 


An example of datafill for table MWDATA is shown below. The example consists of the assignment 
of index 0 with a standard North American level of 0 dB and a frequency of 1004 Hz. 





Datafill Example for Table MWDATA 





Example of a MAP display: 


IDXKEY MWDATA 








0 0 1004 
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Rent—A-Cop Jammer 


Overview 


This is a simple, little battery operated device to "jam" those poorly designed UHF repeater systems 
which are commonly used by the security guards (Rent-A—Cops) at shopping malls. The vast 
majority of these UHF repeater systems operate between 450 MHz and 470 MHz and use the "plus 
5 MHz offset access system". What this means is, the repeater's INPUT frequency is exactly 5 MHz 
higher than the repeater's OUTPUT frequency. This device uses this fact to mix (with a 
Mini—Circuits ASK—-1) the repeater's own OUTPUT frequency with a 5 MHz clock oscillator signal to 
generate a new signal, which will be equal to the repeater's INPUT frequency. 


When this device is placed near the repeater's antenna system, the repeater will essentially "jam" 
itself. The next time the repeater is accessed, the repeater's output signal will "mix up" to hold the 
repeater open — rendering it unusable. This is a very good prank to play on those asshole mall 
security guards who are always hassling you. 


The main drawback is that the jammer needs to be placed fairly close (within about 50 feet) to the 
repeater system's transmit & receive antenna. Most repeater systems will use the same antenna for 
both transmitting and receiving, but on some systems, the antennas are separated to improve 
coverage. You may need to throw the jammer device on a rooftop, or in some nearby trees (best) 
to be effective. Practice makes perfect! For the antennas, nothing fancy is needed. 6 inch pieces 
of #30 gauge wire make good, easily hidden, 1/4—wavelength antennas at around 460 MHz. 


Repeater systems which do not use the "5 MHz offset system" are also susceptible to this type of 
jamming. You'll just need to generate a clock signal which is equal the repeater's required offset 
frequency. For example, 2—meter amateur radio repeater systems normally use a 600 kHz input 
offset. To generate a 600 kHz clock signal, take a 6 MHz clock oscillator and divide its output by 10 
with a 74LS90 counter. Everything else remains the same, with only the antennas changed to 19 
inch long pieces of wire. 
This type of mixing jammer is not effective against repeater systems which output (transmit) a 
different Private Line (PL) tone than the one required for the input (receive). This is done, in fact, to 
prevent this type of jamming. 
Useful Part Numbers & Notes 

e 5 MHz Full Size (TTL/CMOS) Clock Oscillator —- Mouser Stock No. 520-TCF500 

¢ 6 MHz Full Size (TTL/CMOS) Clock Oscillator - Mouser Stock No. 520-TCF600 

e 74LS90 (DIP14) Decade Counter — Mouser Stock No. 526—NTE74LS90 


UHF repeater systems which operate between 470 MHz and 512 MHz tend to use a 3 MHz input 
offset. 
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Schematics 


Rent-A-Cop Jammer  winicircuits 5 MHz 










Clock 
Oscillator 
IF Output 
(To Antenna) |: 
RF Input 
(To Antenna) NC 
Example 
Repeater Output : 464.875 MHz 100 
Repeater Input : 469.875 MHz 
Offset : 5.000 MHz 
+9 VDC 
50 Q microstrip line or coax 
600 kHz Oscillator 
To Mixer 0.1 HF 
(600 kHz) 
+9 VDC 74LS90 
Divide-by-10 


NC ui 
6 MHz i +9 VDC 
Clock Oscillator 
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Receiving 900 MHz Band Cordless Phones 


This is a overview of a really nice 900 MHz Yagi antenna, band pass filter, and receive pre—amplifer 
one can use to greatly enhance their SIGINT reception of normal (unencrypted, non-digital), 
Frequency Modulated (FM), 900 MHz band cordless phones. 


The 902 MHz to 928 MHz Part 15 band is an operating haven for today's cordless phones. Lots of 
people have been leaving their "new" 2.4 GHz and 5.8 GHz phones (which have horrible range and 
can disrupt wireless LAN devices) for the good ole’ 900 MHz band phones. The main reason for 
this is simple, phones operating in the 900 MHz will have greater range due to their lower 
wavelength. This little fact also helps us SIGINT guys monitor our neighborhood Commies, Nazis, 
$2600 readers, terrorists, nutcases, etc. 


The first part of this setup is the antenna. Thankfully, good high-gain antennas are available 
commercially for low cost. Yes, that's right. Fair Radio sells the Antenna Specialists Model 
#ASPJ2996, 7-element Yagi antenna for only $19.95. This antenna is meant for the 928 MHz to 
960 MHz Studio—to—Transmitter Link (STL) band, but works beautifully in the 902-928 MHz 

band. There is a slight gain roll-off on the lower frequencies due to the SWR mismatch, but the 
gain will still be around 8 GBi. 


Antenna Specialists Model #ASPJ2996 Antenna 





<-- Point in Direction of Receive Point Towards Interference --> 


Mount this antenna, vertically polarized (elements running up—and—down), as high as possible, 
away from any nearby trees or metal objects, and pointing to your target's general location. A neat 
trick with directional antennas of this type is that you can "null" out any interfering co—channel 
stations by pointing the back—end of the antenna (the part with the N—connector) at the intefering 
station. This is very useful for "nulling—out" those interfering 900 MHz pager stations or other 
in-band cordless phones. Also, those cheap Radio Shack TV antenna rotators are very handy for 
providing complete 360° rotaing antenna coverage. You'll want to use very high-quality coaxial 
cable for all the long antenna feedline runs. Times Microwave LMR-400, "name brand" RG-8, or 
Belden 9913 (all using N—connectors) is the probably the best choice right now, and easiest to 
obtain. Avoid RG—58 (except for short jumpers) or Radio Shack RG-8 coax, it's crap. RG-6QS (75 
ohm, Quad-Shield), with adapters for the F—connectors, works surprisingly well in a pinch. 
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This next part of this setup is the Band Pass Filter (BPF) after the antenna and in-front of the 
receive pre-amplifier. This device helps to attenuate out-of-band RF interference from the 880 
MHz cellular phone and 929 MHz pager bands. This will prevent signals from overloading the 
pre-amplifier's front-end and causing any intermodulation degradation. My favorite BPF is the 
ComNav Engineering 8BCR12C-915/C25-Dx. This is actually the BPF used in the 900 MHz 
Metricom Ricochet pole—top RF modems, which where popular in the late 1990s. 





ComNav Model 8BCR12C-915/C25-DxX Filter on a Ricochet RF Modem 





The above picture is a 900 MHz Metricom Ricochet RF modem PC board showing the ComNav 
Model 8BCR12C-915/C25-Dx filter (the long silver rectangle on the right). To remove it, heat the 
underside of the PC board with a slowly rotating hot-air gun. The filter will fall right out when the 
heated board is turned upside down. The RF input to the filter is the end nearest the PC board's RF 
connector. You'll need to make some small coax jumpers to connect to the antenna's feedline and 
the receive pre—amplifier. The performance specifications for this ComNav filter are: 





Center Frequency : 913.5 MHz 
2.5 dB Loss : 906 - 921.5 MHz 
4.0 dB Loss : 902 —- 925.5 MHz 
30 dB Rejection : 895 & 929 MHz (pagers at 929 MHz) 
50 dB Rejection : 880 & 945 MHz (cellular phones at 880 MHz) 
Passband VSWR : 1.7:1 
Passband Ripple : < 0.25 dB 
RF In/Out Impedance : 50 ohms 





This particular filter is optional, but highly recommended. Digi-Key carries the Toko 
4DFB-915E-10 3-pole BPF equivalent, Part No. TKS2617CT-ND, but its passband isn't nearly 
as sharp. 





The two "prongs" on the filter's ends are the input/output connections. Solder your coax's center 
conductor to the "prong" and the shield of coax to one of the filter's ground tabs. 
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The most important part of this setup is the actual receive Low Noise Amplifier (LNA). Thankfully, 
these are also cheap and easy to obtain. We will be using surplus 821 — 851 
MHz LNA from ,Part No. (RF) KS21583L9, for $65. These where 
originally designed as receive pre—amplifiers for the 800 MHz cellular site uplink (receive) frequency 
band. They will also work beautifully in the 902 — 928 MHz band. 


M/A—Com AM-1383A Low Noise Amplifier 








A drawback to these amplifiers is that they require a clean +24 VDC supply (at around 200 

mA). Voltages down to +18 VDC will work fine as the LNA has an internal regulator. The LNA uses 
SMA connectors for the RF input and output, so small jumper cables should be made to connect it 
to the antenna/filter and the communications receiver. Performance specifications for this LNA are: 


Gain : 44 dB (821 - 851 MHz) 
Noise Figure : 0.8 dB 
Output IP3 : +38 dBm 


On certain communications receivers, usually Radio Shack scanners, this LNA will provide too 
much gain, and can overload the receiver's front-end. Too prevent this, add about a 10 GB resistive 
attenuation pad to the output of the LNA, or flip the "10 dB ATT" switch on the back of some Radio 
Shack scanner models. 





Example of my 900 MHz LNA setup. 
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RF INPUT (from the antenna) is the upper-left N-connector, this feeds the BPF INPUT (the BPF is 
hidden), the BPF OUTPUT goes to the LNA RF INPUT, the LNA RF OUTPUT goes to the 
bottom-—left N-connector, then to a Radio Shack PRO-2042 scanner. This is all powered from a 
linear +24 VDC power supply (RED wire positive). 





Here is the outside case overview of the complete amplifier assembly. It is housed in an old ammo 
box, with all the holes sealed with rubber washers or sealant to make it somewhat water 

resistant. The RF input is on the left, the RF output is on the right. The switch, 1 Amp fuse, and 
green neon light control the power supply. The protection bars are brass drawer handles. A plug 
for the 120 VAC power cord is provided on the rear of the ammo box. 


To use the new amplifier assembly, connect it between your directional antenna and your 
communications receiver capable of tuning between 902 MHz and 928 MHz in 5 kHz steps 
(narrowband & wideband FM). There really is no bandplan to the 900 MHz band, but you'll usually 
find the cordless phone's HANDSET transmitting around 924 — 928 MHz and the BASE transmitting 
between 902 — 908 MHz. Scanning the BASE frequencies will allow you to hear both sides of the 
conversation (in analog hybrid systems) and will usually also have a higher output RF power. Use 
both 5 kHz and 12.5 kHz steps to scan the band and use the narrow or wide FM selection mode to 
maintain the highest receivability. 
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The Radio Shack PRO-—2035/2042 line of scanners is ideal for monitoring the 900 MHz cordless 
phone band. The picture on the left is of a PRO-2042 scanner with its stock BNC connector 
replaced with a N-connector. This allows the use of high-quality connecting coaxial cables. The 
IC picture on the right is of a 8,000 channel modification to the PRO-2042. Both of these 
modifications are also highly recommended. The 8,000 channel modification is covered in detail 
here: http:/Avww.dafh.org/gbppr/mil/rsscanner. 


Installing a 2-Piece N-Connector on RG-8-type Coax 


14 mm 
| | 
RG-8 1. Strip cable as shown. Be careful not to nick the 
or. | Za center conductor. 
eqiv. Center 
40mm Conductor 
t 
2. Remove jacket as shown. Be careful not to nick the 
\ coax Braid 
3. Screw body onto cable as far as it will go. 
Solder Holes 


4. Solder braid through the two holes in the body. 
Solder the center through the hole in the pin. 
The solder must seal the holes for the connector to be 
waterproof. 





5. When the connector cools, screw the shell assembly 
onto the body. Wrench tighten until the shell assembly 
bottoms on the hex. 
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Be N-Connector Shell Assembly 


41 


Bonus 


This GBPPR ‘Zine Bonus Section is going to be a little different this month. 
| use to have an old DMS-100 Quick Reference Guide from the 1990's which | always wanted to 
type—up for a phreaking file, but just never got around to doing it (it's huge). Well... | was poking 
around Nortel's website and whaddaya know ... they now offer the DMS-—100 Quick Reference 
Guide as a PDF download! 
This manual covers the commonly used Command Interpreter (Cl) commands, table editor 
commands, circuit pack descriptions and numbers, hardware shelf diagrams, SuperNode hardware, 
even the DIP switch settings for line cards. No more digging through dumpsters anymore! BTW, 
this is (one of) the manuals which is used for alot of the DMS-—100 files you see around in Internet 
(in Phrack, etc.). 


Download the Nortel DMS-100 Family - Quick Reference Guide — 2002 (2.9 MB PDF) at one the 
following URLs: 


http://www.dafh.org/gbppr/zine2/dms100_quick_ref_guide.pdf (Fast) 
http://goppr.dyndns.org/PROJ/zine2/dms100_quick_ref_guide.pdf (Very Very Slow) 

Or directly from Nortel (TAM—1001-—018-—UPDATES -— 2002): 

http://www1 30.nortelnetworks.com/cgi—bin/eserv/cs/main.jsp ?cscat=documentation&tranProduct=8207 


This is a must read file! Also, be sure to grab those other PDF files on Nortel's website. 
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End of Issue #7 





Editorial and Rants 





"I love the smell of burning Mosques in the morning...lt smells like--Victory." 
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